<html>
<head><meta charset="utf-8"><title>lock poisoning survey · t-libs · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/index.html">t-libs</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html">lock poisoning survey</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="209461725"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/209461725" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#209461725">(Sep 09 2020 at 00:54)</a>:</h4>
<p>Hey all! I've started sketching out a survey based on <span class="user-mention" data-user-id="219696">@XAMPPRocky</span>'s suggestion to find out how poisoning is used out in the wild: <a href="https://hackmd.io/icmi6sjlRcKkL9T49iQiDg">https://hackmd.io/icmi6sjlRcKkL9T49iQiDg</a></p>
<p>What do you all think?</p>



<a name="209461771"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/209461771" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#209461771">(Sep 09 2020 at 00:55)</a>:</h4>
<p>Would a post on the Rust blog with a link to the survey be appropriate? Or would the users/internals forum be better?</p>



<a name="209461849"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/209461849" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#209461849">(Sep 09 2020 at 00:56)</a>:</h4>
<p>I think rust blog would be fine, certainly inside rust</p>



<a name="209461859"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/209461859" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#209461859">(Sep 09 2020 at 00:56)</a>:</h4>
<p>But I think main blog is the place for this</p>



<a name="209461866"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/209461866" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#209461866">(Sep 09 2020 at 00:56)</a>:</h4>
<p>Of course linked to from forums</p>



<a name="209461993"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/209461993" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#209461993">(Sep 09 2020 at 00:59)</a>:</h4>
<p>Is there somewhere I should ask about any considerations we have for running surveys through the project?</p>



<a name="209462763"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/209462763" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#209462763">(Sep 09 2020 at 01:15)</a>:</h4>
<p>Hm I don't think so - we usually do google forms, nothing too special</p>



<a name="209462828"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/209462828" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#209462828">(Sep 09 2020 at 01:17)</a>:</h4>
<p>If you want it translated then I'd ask Niko - he has an up to date list of volunteers (we're running main 2020 survey starting Thursday, so they've all been pinged recently)</p>



<a name="209462922"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/209462922" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#209462922">(Sep 09 2020 at 01:19)</a>:</h4>
<p>For the survey, we will want an accompanying short post for it. I think an explanation of what poisoning is would be good, I suspect many don't know</p>



<a name="209462987"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/209462987" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> simulacrum <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#209462987">(Sep 09 2020 at 01:20)</a>:</h4>
<p>It's also sort of true that anyone using std lock types today "depends" on it to some extent since behavior would be different almost certainly without it</p>



<a name="209465162"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/209465162" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Amanieu <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#209465162">(Sep 09 2020 at 02:08)</a>:</h4>
<p>Question: Have you ever used a crate like <code>antidote</code> or <code>parking_lot</code> to avoid having to add <code>unwrap</code> all over your code?</p>



<a name="209465491"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/209465491" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#209465491">(Sep 09 2020 at 02:16)</a>:</h4>
<p>Nice and direct <span aria-label="grinning face with smiling eyes" class="emoji emoji-1f601" role="img" title="grinning face with smiling eyes">:grinning_face_with_smiling_eyes:</span></p>



<a name="209466059"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/209466059" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#209466059">(Sep 09 2020 at 02:28)</a>:</h4>
<p>I'll work on an accompanying post while we decide on the exact shape of the questions <span aria-label="smile" class="emoji emoji-1f642" role="img" title="smile">:smile:</span></p>



<a name="209520875"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/209520875" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> pickfire <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#209520875">(Sep 09 2020 at 14:46)</a>:</h4>
<p>We should also run a survey to ask how people feel about <code>const fn</code>, CC <span class="user-mention" data-user-id="120791">@RalfJ</span>.</p>



<a name="209528160"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/209528160" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#209528160">(Sep 09 2020 at 15:34)</a>:</h4>
<p>Not sure what exactly you mean but it seems unrelated to lock poisoning, so maybe open a new thread?^^</p>



<a name="210610846"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210610846" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lukas Kalbertodt <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210610846">(Sep 19 2020 at 11:38)</a>:</h4>
<p>I'm not sure if I missed previous discussion on this, but has <a href="http://joeduffyblog.com/2016/02/07/the-error-model">"The Error model"</a> been brought up in this context? It's a fairly popular blog post on how to deal with errors in programming. Rust's error handling model is very close to the conclusion of that blog post: statically checked "recoverable errors" and abandonment in case of bugs. Particularly the later part is interesting in regards to poisoning:</p>
<p>The author says that the correct response to a bug is to tear down the current process as everything the buggy code might have touched should be considered tainted. Rust's "abandonment" model, panics, only tears down the current thread, which is a lot less isolated than processes. But that's whats poisoning helps with: to better isolate a buggy (panicked) thread. </p>
<p>So what I'm getting at: from my understanding, removing poisoning would steer Rust a bit further from the "clean abandonment" model in that blog post.</p>



<a name="210611097"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210611097" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210611097">(Sep 19 2020 at 11:45)</a>:</h4>
<p>survey seems to ignore that <code>.lock().unwrap()</code> is very different from using a non-poisoning locks</p>



<a name="210611113"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210611113" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210611113">(Sep 19 2020 at 11:45)</a>:</h4>
<p><code>.lock().unwrap()</code> causes every thread that shares the data to eventually panic if one does, whereas non-poisoning allows the other threads to continue</p>



<a name="210611211"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210611211" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210611211">(Sep 19 2020 at 11:47)</a>:</h4>
<p>(not that im against removing lock poisoning necessarily)</p>



<a name="210611325"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210611325" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210611325">(Sep 19 2020 at 11:50)</a>:</h4>
<p>that is, the answer to "Do you use the poisoning behavior of the standard library’s lock types in any of your projects?" should be <code>yes</code> for anyone who calls <code>.lock().unwrap()</code></p>



<a name="210611349"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210611349" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210611349">(Sep 19 2020 at 11:51)</a>:</h4>
<p>the real questions seems more like "have you ever thought carefully about lock poisoning when using a mutex?" and "do you feel you've benefit from the poisoning default?" and "have you ever written code to ignore the poisoning of the std mutex?"</p>



<a name="210616470"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210616470" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210616470">(Sep 19 2020 at 13:56)</a>:</h4>
<p><span class="user-mention" data-user-id="118772">@Lukas Kalbertodt</span> I think that author is just wrong though.</p>



<a name="210616580"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210616580" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lukas Kalbertodt <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210616580">(Sep 19 2020 at 13:59)</a>:</h4>
<p><span class="user-mention" data-user-id="224471">@Lokathor</span> Sure, didn't mean to say that the post is completely correct. I guess the new error handling WG could think about that...</p>



<a name="210617712"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210617712" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jane Lusby <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210617712">(Sep 19 2020 at 14:25)</a>:</h4>
<p><span aria-label="eyes" class="emoji emoji-1f440" role="img" title="eyes">:eyes:</span></p>



<a name="210641549"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210641549" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210641549">(Sep 20 2020 at 00:10)</a>:</h4>
<p>Thanks for the suggestions everyone! How is this looking now? <a href="https://docs.google.com/forms/d/e/1FAIpQLSehk-GkwoCag_w3YfXDfgeANulR0h5m2d3EzUMQaiY1vRfIEw/viewform">https://docs.google.com/forms/d/e/1FAIpQLSehk-GkwoCag_w3YfXDfgeANulR0h5m2d3EzUMQaiY1vRfIEw/viewform</a></p>



<a name="210641612"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210641612" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210641612">(Sep 20 2020 at 00:13)</a>:</h4>
<p>I’ve tried to word it so users could indicate that they <code>.lock().unwrap()</code> or ignore poisoning and either do or don’t care about it</p>



<a name="210649952"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210649952" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210649952">(Sep 20 2020 at 05:09)</a>:</h4>
<blockquote>
<p><span class="user-mention silent" data-user-id="118772">Lukas Kalbertodt</span> I think that author is just wrong though.</p>
</blockquote>
<p><span class="user-mention" data-user-id="224471">@Lokathor</span> Can you expand on that? What do you think the author is wrong about?</p>



<a name="210651226"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210651226" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210651226">(Sep 20 2020 at 05:54)</a>:</h4>
<p><span class="user-mention" data-user-id="204346">@Ashley Mannix</span> Sure, I was responding to this point:</p>
<blockquote>
<p>The author says that the correct response to a bug is to tear down the current process as everything the buggy code might have touched should be considered tainted.</p>
</blockquote>
<p>Which is like... just <em>very</em> out there as a concept. Like, so if there's a bug in some edge case of parsing user input, you should just crash the entire sever? Even though most requests are coming in and sending back out replies just fine? I can't accept that as reasonable.</p>
<p>I'm sure there are some places where you want to blow up the universe in response to a single bug, but those are probably not too many.</p>



<a name="210651276"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210651276" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210651276">(Sep 20 2020 at 05:55)</a>:</h4>
<p>If we use "process" more liberally to mean "unit of work" and then say "oh well if there's a parse error we just reject that request and move on", then <em>that</em> would be a fine take.</p>



<a name="210651343"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210651343" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210651343">(Sep 20 2020 at 05:57)</a>:</h4>
<p>(I will admit to not having read the full article, just the summary that Lukas wrote about it)</p>



<a name="210652552"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210652552" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> XAMPPRocky <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210652552">(Sep 20 2020 at 06:41)</a>:</h4>
<p><span class="user-mention" data-user-id="224471">@Lokathor</span> If bug in this case is defined as undefined behaviour and not a recoverable error (as the error post mentions) then I believe the correct thing to do is to crash the server, and it is what you want in most cases.</p>
<p>You would not want your HTTP client/server to accept malicious TLS certificate no matter what. Parsers accepting input that leads to undefined behaviour is where a lot of biggest security vulns have come from.</p>



<a name="210652976"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210652976" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210652976">(Sep 20 2020 at 06:54)</a>:</h4>
<p>Well UB is very different from how the summary posted within this zulip topic put it XD.</p>



<a name="210652989"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210652989" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210652989">(Sep 20 2020 at 06:55)</a>:</h4>
<p>though i opened the article just now to try and get some extra context and and couldn't find where "undefined" is written at all.</p>



<a name="210656802"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210656802" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210656802">(Sep 20 2020 at 08:56)</a>:</h4>
<p>Ah ok I see where you’re coming from now 👍 I guess that also relates to the panic=abort discussion on one hand, and to the way panics are sometimes treated as DoS vulnerabilities on the other. Panics indicate bugs, but bugs happen and safe systems are built to tolerate buggy components</p>



<a name="210664111"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210664111" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> boats <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210664111">(Sep 20 2020 at 12:12)</a>:</h4>
<p>I filled out the survey and thought it was good!</p>



<a name="210668759"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210668759" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Steven Fackler <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210668759">(Sep 20 2020 at 14:13)</a>:</h4>
<p>From the perspective of working on servers, I have always found the "well, you should just abort on bugs" kind of ridiculous. If 0.1% of requests start hitting a panic at 2AM due to some bug and the server unwinds on panic, it's a thing I can fix the next day at my leisure. If the entire server process is crashing every 1,000 requests, I am going to get paged and have to fight a fire in the middle of the night. I have literally never encountered a bug in production that I wished had killed the entire process rather than panicking.</p>



<a name="210669369"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210669369" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210669369">(Sep 20 2020 at 14:28)</a>:</h4>
<p><a href="http://docs.rs">docs.rs</a> actually goes even further and uses <code>catch_unwind</code> for the builds thread (although it doesn't help much, since usually if it panics once it will panic every time)</p>



<a name="210669380"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210669380" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210669380">(Sep 20 2020 at 14:29)</a>:</h4>
<p>But yes abort() on error would be completely unsustainable</p>



<a name="210669433"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210669433" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210669433">(Sep 20 2020 at 14:30)</a>:</h4>
<p>I wrote this up on hacker news a while back: <a href="https://news.ycombinator.com/item?id=22938055">https://news.ycombinator.com/item?id=22938055</a></p>



<a name="210672030"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210672030" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lukas Kalbertodt <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210672030">(Sep 20 2020 at 15:43)</a>:</h4>
<p>I probably haven't done a good job of summarizing the article. I think the article lays out the reasoning pretty well, but I also know it's long -- sorry!.Regarding crashing the whole webserver: </p>
<p>I am pretty sure the author, by talking about "process", means "unit of isolation". As in: everything that buggy code might have influenced should be considered invalid. Within reason of course. If your webserver handles each request individually and in an isolated fashion (as it should usually be the case), then just panicking for that one request and responding 5xx, but keeping the server running is perfectly reasonable. And I think it doesn't conflict with the blog article I posted: "architect your system so that the whole remains functional even when individual pieces fail". </p>
<p>And well, one way that "isolation of threads" is violated is via sharing data via mutexes. If one thread of a webserver panics while holding a global lock, then it might be worth thinking about whether the whole server should stop.</p>



<a name="210672047"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210672047" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lukas Kalbertodt <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210672047">(Sep 20 2020 at 15:43)</a>:</h4>
<p>I didn't intend to derail the discussion into error handling though :/</p>



<a name="210674218"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210674218" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210674218">(Sep 20 2020 at 16:38)</a>:</h4>
<p>I think error handling and mutex poisoning are very related</p>



<a name="210674225"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210674225" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210674225">(Sep 20 2020 at 16:38)</a>:</h4>
<p>the <a href="http://docs.rs">docs.rs</a> case is a little odd because we have no shared state, all the state comes from the database</p>



<a name="210674241"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210674241" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210674241">(Sep 20 2020 at 16:39)</a>:</h4>
<p>so it kind of sidesteps the question</p>



<a name="210695050"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210695050" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210695050">(Sep 21 2020 at 01:40)</a>:</h4>
<p>From the perspective of shipping a product to end users panic=abort is never what I want either. It's the difference between "log and fail gracefully" and "fall flat on your face and have to fiddle with crash dumps". But yeh I guess it's all a question of service boundaries how failures are surfaced. I think the wider point is that as with lots of things there are many equally valid usecases with different needs to accommodate <span aria-label="smile" class="emoji emoji-1f642" role="img" title="smile">:smile:</span></p>



<a name="210695075"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210695075" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210695075">(Sep 21 2020 at 01:41)</a>:</h4>
<p>I'm going to be really interested to see what kinds of combinations we get back on the questions about what you want to happen when you hit a poisoned mutex</p>



<a name="210696440"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210696440" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210696440">(Sep 21 2020 at 02:20)</a>:</h4>
<p><span class="user-mention" data-user-id="204346">@Ashley Mannix</span> You can still report and fail gracefully from a panic, you just have to do it from a panic hook, or arrange to have the program supervised.</p>



<a name="210699750"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210699750" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210699750">(Sep 21 2020 at 04:02)</a>:</h4>
<p>Yep, there's lots of different approaches <span aria-label="smile" class="emoji emoji-1f642" role="img" title="smile">:smile:</span></p>



<a name="210736550"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/210736550" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Amanieu <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#210736550">(Sep 21 2020 at 12:56)</a>:</h4>
<p>IMO unwinding is useful only if there is the possibility of containing the failure: the typical example is to fail just one request on a server instead of taking the whole process down. If you're taking the whole process down regardless then you might as well just abort.</p>



<a name="211029491"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/211029491" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> pickfire <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#211029491">(Sep 23 2020 at 16:40)</a>:</h4>
<p><span class="user-mention" data-user-id="204346">@Ashley Mannix</span> Survey is nice but I think it would be good to autoskip a section if a user select "no", not sure if that's possible.</p>
<blockquote>
<p>If you use locks from outside the standard library<br>
This section applies if you answered “yes” to using other lock types in any of your projects.</p>
</blockquote>



<a name="211074190"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/211074190" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#211074190">(Sep 23 2020 at 23:26)</a>:</h4>
<p><span class="user-mention" data-user-id="225422">@pickfire</span> I couldn’t find a way to do that with Google Forms but it would be nice to be able to auto skip sections</p>



<a name="211075989"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/211075989" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> DPC <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#211075989">(Sep 23 2020 at 23:57)</a>:</h4>
<p>it's possible, you need to define a new section and there's a place where you can define the flow from one section to the other, but i guess it's too late for that <span aria-label="grinning" class="emoji emoji-1f600" role="img" title="grinning">:grinning:</span></p>



<a name="211104619"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/211104619" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#211104619">(Sep 24 2020 at 08:58)</a>:</h4>
<p><span class="user-mention" data-user-id="120823">@DPC</span> Not at all <span aria-label="big smile" class="emoji emoji-1f604" role="img" title="big smile">:big_smile:</span> We haven’t officially posted it yet</p>



<a name="215458154"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/215458154" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jake Goulding <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#215458154">(Nov 03 2020 at 14:14)</a>:</h4>
<p>Just passing through, but I recently benefited from the the ability to recover from poison:</p>
<div class="codehilite" data-code-language="Diff"><pre><span></span><code><span class="gd">--- a/ui/src/sandbox.rs</span>
<span class="gi">+++ b/ui/src/sandbox.rs</span>
<span class="gu">@@ -860,6 +860,22 @@ pub struct MacroExpansionResponse {</span>
 mod test {
     use super::*;

<span class="gi">+    // Running the tests completely in parallel causes spurious</span>
<span class="gi">+    // failures due to my resource-limited Docker</span>
<span class="gi">+    // environment. Additionally, we have some tests that *require*</span>
<span class="gi">+    // that no other docker processes are running.</span>
<span class="gi">+    fn one_test_at_a_time() -&gt; impl Drop {</span>
<span class="gi">+        use lazy_static::lazy_static;</span>
<span class="gi">+        use std::sync::Mutex;</span>
<span class="gi">+</span>
<span class="gi">+        lazy_static! {</span>
<span class="gi">+            static ref DOCKER_SINGLETON: Mutex&lt;()&gt; = Default::default();</span>
<span class="gi">+        }</span>
<span class="gi">+</span>
<span class="gi">+        // We can't poison the empty tuple</span>
<span class="gi">+        DOCKER_SINGLETON.lock().unwrap_or_else(|e| e.into_inner())</span>
<span class="gi">+    }</span>
<span class="gi">+</span>
     const HELLO_WORLD_CODE: &amp;'static str = r#"
     fn main() {
         println!("Hello, world!");
<span class="gu">@@ -907,6 +923,7 @@ mod test {</span>

     #[test]
     fn basic_functionality() {
<span class="gi">+        let _singleton = one_test_at_a_time();</span>
         let req = ExecuteRequest::default();

         let sb = Sandbox::new().expect("Unable to create sandbox");
</code></pre></div>



<a name="215458987"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/215458987" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mara <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#215458987">(Nov 03 2020 at 14:20)</a>:</h4>
<p>That <code>.unwrap_or_else(|e| e.into_inner())</code> makes me think an <code>.ignore_poison()</code> would be nice. But I guess something like that probably has come up before?</p>



<a name="215466011"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/215466011" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Philipp Korber <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#215466011">(Nov 03 2020 at 15:13)</a>:</h4>
<p>Yes I have run into that one or two times, there are situations where you can be sure that even if the lock is poisend the guarded data is still valid.</p>



<a name="215466156"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/215466156" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Steven Fackler <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#215466156">(Nov 03 2020 at 15:14)</a>:</h4>
<p>It'd be a bit weird or at least undiscoverable to add <code>.ignore_poison</code> since it'd need to be an impl on <code>Result&lt;T, PoisonError&lt;...&gt;&gt;</code></p>



<a name="215466312"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/215466312" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mara <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#215466312">(Nov 03 2020 at 15:15)</a>:</h4>
<p>it'd be easy to find if <code>.lock()</code> itself documents it</p>



<a name="215467532"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/215467532" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Philipp Korber <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#215467532">(Nov 03 2020 at 15:24)</a>:</h4>
<p>Or something like <code>.lock_ignoring_poisen()</code>, <code>.lock_poisond()</code>.</p>



<a name="215467644"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/215467644" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Steven Fackler <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#215467644">(Nov 03 2020 at 15:24)</a>:</h4>
<p>If we're going to add an API, we should just add a non-poisoning mutex</p>



<a name="215468010"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/215468010" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Philipp Korber <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#215468010">(Nov 03 2020 at 15:27)</a>:</h4>
<p>I think that would unnecessary complexity. IMHO I like that the current mutex forces you to think about poisoning. Especially if you are new to programming thinks like that are excellent to help you become a better programmer, and even if your are not new they still make you remember that you should properly handle panics.</p>



<a name="215469023"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/215469023" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Mara <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#215469023">(Nov 03 2020 at 15:34)</a>:</h4>
<p>and a non-poisoning condvar and a non-poisoning rwlock? i'm all for it. but that's a much bigger api change. adding .ignore_poison() on the LockResult covers all those cases. and not having to switch the type just to be able to ignore posion is also useful.</p>



<a name="219685723"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219685723" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> moxian <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219685723">(Dec 12 2020 at 03:07)</a>:</h4>
<p>Hi folks! I didn't read the backlog, so this might have been brought up already, but the thing I realized while reading the article/filling the survey is that I have never actually thought about poisoning much (if at all).<br>
If std had "better" locking primitives that have no poisoning ("better" as in - shorter API/faster performance) - I'd use those without second thought <em>despite</em> the fact that it would make my programs incorrect (because, again, I didn't even <em>think</em> it would be possible for them to be incorrect here)</p>
<p>So, constructively, I would ask for the non-poisoning locks to have either big scary warnings on the doc page, or have them be <code>unsafe</code>, or more cumbersome to construct, or (and this might be the best one) simply not release the lock if being dropped during a panic (and thus stay locked, forever, until manual intervention (like <code>.force_unlock()</code> or something)). So that the user takes notice that something is off, and does not silently gets their data corrupted.</p>
<p>Just my 2c.</p>



<a name="219686718"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219686718" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219686718">(Dec 12 2020 at 03:32)</a>:</h4>
<p>I would really prefer it not to deadlock, that would be make it really hard to find what's <em>actually</em> a deadlock vs a panic that wasn't addressed</p>



<a name="219686721"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219686721" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219686721">(Dec 12 2020 at 03:32)</a>:</h4>
<p>big scary warnings seems fine</p>



<a name="219689691"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219689691" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> moxian <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219689691">(Dec 12 2020 at 04:41)</a>:</h4>
<p>I  want to argue that deadlocking on panic is good.<br>
Two (and a half) arguments: 1) this is how it works in "other languages", and it's an unsurprising behavior. You usually have something like</p>
<div class="codehilite"><pre><span></span><code>mutex.lock()
do_stuff()  // this might throw an exception/panic/terminate the thread/whatever
mutex.unlock()
</code></pre></div>
<p>Mimicking that is at least "not a regression" [coming from other languages]<br>
Also note that this even happens in languages that use exceptions as a control flow, and where such "panics" are much more common.</p>
<p>2) if the non-poisoning API is more ergonomic (due to the lack of <code>.unwrap()</code>s), then people who don't really think about intricacies of concurrency and poisoning (i.e., me) would tend to use this "simpler" API over the poisoning one ("because they don't need this advanced feature" or similar).<br>
When they switch from the poisoning locks to non-poisoning, release-on-panic locks, their programs' behavior change from "stop doing anything useful upon a panic" to "silently operate on corrupted data upon a panic" (which is really really bad!!). This behavior, however, is not changed, if they switch to stay-locked-on-panic locks - the program continues to "not do anything useful", just in a slightly different shape now.<br>
So, again, deadlocking on panic is "not a regression" [coming from naive use of current <code>std</code> locks that doesn't handle poisoning]</p>
<p>3) I don't even think the distinction between "genuine deadlock" [that arose because you failed to maintain an invariant] vs "panic-induced deadlock" [that arouse because you failed to restore invariant upon a panic, that you did handle, but only partially] is meaningful. It is probably nice during development, but not so much in production. And, if you really care about the two - maybe poisoning locks is what you really want here?..</p>



<a name="219690289"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219690289" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> moxian <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219690289">(Dec 12 2020 at 04:58)</a>:</h4>
<p>In short, I believe unlocking the mutex upon panic is a footgun, and I think we should be weary adding that to <code>std</code></p>



<a name="219690419"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219690419" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> moxian <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219690419">(Dec 12 2020 at 05:01)</a>:</h4>
<p>And now that I think about it, having two poison-less mutex types - one that release lock on panic, and one that doesn't - might satisfy both parties here.</p>



<a name="219695451"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219695451" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219695451">(Dec 12 2020 at 07:24)</a>:</h4>
<p>I would love to have a poisonless lock whose behavior is to abort the process on panic if panic=unwind, or compile out all panic handling if panic=abort.</p>



<a name="219695520"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219695520" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219695520">(Dec 12 2020 at 07:26)</a>:</h4>
<p>No error case either way. That would work for any program that doesn't try to handle lock poisoning except by propagating a panic.</p>



<a name="219708676"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219708676" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Steven Fackler <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219708676">(Dec 12 2020 at 13:20)</a>:</h4>
<p>Can you expand on a concrete use case where you want to unwind panics unless you happen to be holding some lock at the time? That seems like a somewhat artificial middle ground.</p>



<a name="219716025"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219716025" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> cuviper <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219716025">(Dec 12 2020 at 16:32)</a>:</h4>
<p>It would be similar to aborting for panics during unwinding, and IIRC it's been proposed that all panics during drop should abort too. This would be suggesting the same for panics during a critical section (holding a lock).</p>



<a name="219717591"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219717591" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Steven Fackler <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219717591">(Dec 12 2020 at 17:12)</a>:</h4>
<p>Changing panics during drop to abort would be pretty clearly a breaking change.</p>



<a name="219721804"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219721804" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219721804">(Dec 12 2020 at 18:51)</a>:</h4>
<p>I have the same comment as in <a href="https://internals.rust-lang.org/t/design-rationale-why-uncaught-panics-in-threads-dont-abort/12992/21">https://internals.rust-lang.org/t/design-rationale-why-uncaught-panics-in-threads-dont-abort/12992/21</a>: this would completely and fundamentally break the design of <a href="http://docs.rs">docs.rs</a></p>



<a name="219721856"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219721856" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219721856">(Dec 12 2020 at 18:52)</a>:</h4>
<p>new APIs are fine but <em>please</em> do not silently change existing ones to crash the process</p>



<a name="219722031"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219722031" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219722031">(Dec 12 2020 at 18:56)</a>:</h4>
<p><a href="https://news.ycombinator.com/item?id=22940836">https://news.ycombinator.com/item?id=22940836</a></p>



<a name="219746383"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219746383" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219746383">(Dec 13 2020 at 06:02)</a>:</h4>
<p><span class="user-mention silent" data-user-id="243558">Steven Fackler</span> <a href="#narrow/stream/219381-t-libs/topic/lock.20poisoning.20survey/near/219708676">said</a>:</p>
<blockquote>
<p>Can you expand on a concrete use case where you want to unwind panics unless you happen to be holding some lock at the time? That seems like a somewhat artificial middle ground.</p>
</blockquote>
<p>The concrete use case is that otherwise, if I panic in a Mutex, I end up with a poisoned Mutex, and assuming I don't attempt to recover whatever inconsistent state the protected data is in, the only thing I'm likely to do is propagate the panic in the <em>next</em> thread that touches the Mutex, so I'd rather fail fast rather than slowly disintegrating over time.</p>



<a name="219746403"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219746403" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219746403">(Dec 13 2020 at 06:03)</a>:</h4>
<p>And failing fast also means the mutex doesn't have to track any kind of poisoned state.</p>



<a name="219746446"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219746446" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219746446">(Dec 13 2020 at 06:04)</a>:</h4>
<p>(Also, for clarity, I'm aware that we can't change the existing <code>Mutex</code> without breaking backwards compatibility. I was suggesting the behavior I'd hope for from an alternative non-poisoning <code>Mutex</code>.)</p>



<a name="219746613"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219746613" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Jacob Lifshay <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219746613">(Dec 13 2020 at 06:10)</a>:</h4>
<p>maybe have the non-poisoning lock require wrapped types to implement <code>UnwindSafe</code>? (or whatever that trait is called, icr)</p>



<a name="219761338"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219761338" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Steven Fackler <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219761338">(Dec 13 2020 at 13:21)</a>:</h4>
<p>I'm just still a bit confused as to why in this scenario you're sufficiently paranoid about getting into a bad state post panic with a mutex locked that you'd rather abort the whole process, but 1. are worried enough about panics in other contexts that you don't just want to build with panic=abort, and 2. are confident that you can't end up in a bad state when no lock is being held (e.g. the panic takes down a background thread that is necessary to keep the service stable)</p>



<a name="219770911"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219770911" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219770911">(Dec 13 2020 at 17:30)</a>:</h4>
<p>I mean, I would <em>also</em> generally like uncaught thread panic to abort.</p>
<p>But the issue isn't about paranoia. It's more that recovering from a panic is sufficiently unusual that I feel like it ought to have been opt-in, and I don't want the most commonly used mutexes to spend overhead on handling that case. It's one thing to use catch_unwind for something like "restore the terminal state before exiting". But I would be interested to know how many programs ever expect to <em>recover</em> from a poisoned mutex.</p>



<a name="219771596"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219771596" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Steven Fackler <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219771596">(Dec 13 2020 at 17:48)</a>:</h4>
<p>In the last ~7 years of writing things like webservers in Rust, I have literally never encountered a situation in which I was glad that a mutex was poisoned, or that I wished that I had used a poisoning mutex. There have been plenty of instances in which I wrote a bug that caused a panic, and some of those probably occurred while some lock was being held but in none of them would the service have been better off having aborted or been unable to ever access that data again.</p>



<a name="219771630"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219771630" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Steven Fackler <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219771630">(Dec 13 2020 at 17:49)</a>:</h4>
<p>There's nothing to do to "recover" - the odds are just very high that everything is actually totally fine in the server's internal state</p>



<a name="219771703"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219771703" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Steven Fackler <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219771703">(Dec 13 2020 at 17:51)</a>:</h4>
<p>I have long since abandoned poisoning entirely in favor of parking_lot and/or antidote, and my interaction with poisoning has generally been to file bugs on RLS when e.g. Racer panicked while some totally unrelated lock was being held up-stack resulting in the entire language server being in a state where it failed to respond to any future requests.</p>



<a name="219771781"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219771781" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Steven Fackler <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219771781">(Dec 13 2020 at 17:53)</a>:</h4>
<p>And the solution for RLS was to ignore poisoning, resulting in significant improvements to its stability</p>



<a name="219772294"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219772294" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Steven Fackler <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219772294">(Dec 13 2020 at 18:05)</a>:</h4>
<p>There is also a conflation that bugs=panics here - there are plenty of ways to screw up some code that don't result in a panic but do result in the corruption of some shared state via e.g. an accidental early return from <code>?</code>. A "true" poisoning lock IMO would require you to explicitly "disarm" the guard before it drops for any reason, panic or no.</p>



<a name="219772530"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219772530" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Steven Fackler <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219772530">(Dec 13 2020 at 18:10)</a>:</h4>
<p>In fact, in the one time I actually <em>have</em> intentionally used poisoning, the bad state I was looking to detect was a failed file write and so the API looked for that kind of explicit commit rather than panics</p>



<a name="219816997"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219816997" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219816997">(Dec 14 2020 at 09:30)</a>:</h4>
<p><span class="user-mention silent" data-user-id="243558">Steven Fackler</span> <a href="#narrow/stream/219381-t-libs/topic/lock.20poisoning.20survey/near/219771596">said</a>:</p>
<blockquote>
<p>In the last ~7 years of writing things like webservers in Rust, I have literally never encountered a situation in which I was glad that a mutex was poisoned, or that I wished that I had used a poisoning mutex. There have been plenty of instances in which I wrote a bug that caused a panic, and some of those probably occurred while some lock was being held but in none of them would the service have been better off having aborted or been unable to ever access that data again.</p>
</blockquote>
<p>I'm trying to reconcile your first and second sentences here.</p>



<a name="219817076"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219817076" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219817076">(Dec 14 2020 at 09:30)</a>:</h4>
<p>The two seem to contradict each other somewhat, or I may be misunderstanding you here.</p>



<a name="219834165"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219834165" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Steven Fackler <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219834165">(Dec 14 2020 at 12:29)</a>:</h4>
<p>I'm saying that I have never been in a situation where the intended behavior of poisoning mutexes provided actual value. I.e. I have never thought "wow, I sure am glad that random divide-by-zero bug escalated into a DoS on my shared state"</p>



<a name="219838621"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219838621" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219838621">(Dec 14 2020 at 13:11)</a>:</h4>
<p>So, I <em>do</em> believe the safety property is useful. I think either mutexes should poison, or they should abort on unwind, or they should be unsafe.</p>



<a name="219838937"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219838937" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Steven Fackler <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219838937">(Dec 14 2020 at 13:14)</a>:</h4>
<p>That is not how safety has been defined in Rust for at least 5 years</p>



<a name="219838967"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219838967" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Steven Fackler <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219838967">(Dec 14 2020 at 13:14)</a>:</h4>
<p>And the fact that into_inner is already a safe API on PoisonError means that isn't true today!</p>



<a name="219839232"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219839232" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219839232">(Dec 14 2020 at 13:17)</a>:</h4>
<p>Sigh. Let me try that again.</p>
<p>I do believe the property is useful...</p>



<a name="219846140"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219846140" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219846140">(Dec 14 2020 at 14:15)</a>:</h4>
<p>/me  glances at <a href="https://github.com/rust-lang/docs.rs/issues/1149">https://github.com/rust-lang/docs.rs/issues/1149</a></p>



<a name="219846277"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219846277" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219846277">(Dec 14 2020 at 14:16)</a>:</h4>
<p>all of this is kind of incidental to <a href="http://docs.rs">docs.rs</a> because we don't use mutexes (unless maybe our dependencies do? or <code>iron</code>?) but I definitely agree strongly with <span class="user-mention" data-user-id="243558">@Steven Fackler</span>, we <em>cannot</em> afford to abort the server because of a single bug</p>



<a name="219846319"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219846319" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219846319">(Dec 14 2020 at 14:17)</a>:</h4>
<p>I'd be constantly on call, the site would constantly be down</p>



<a name="219873615"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219873615" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219873615">(Dec 14 2020 at 17:24)</a>:</h4>
<p>I may be a broken record at this point, but I'll mention again that also some shared state <em>cannot</em> enter an inconsistent state (eg: a single field), and thus poisoning is just an annoyance there.</p>



<a name="219899475"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219899475" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219899475">(Dec 14 2020 at 20:45)</a>:</h4>
<p><span class="user-mention silent" data-user-id="224471">Lokathor</span> <a href="#narrow/stream/219381-t-libs/topic/lock.20poisoning.20survey/near/219873615">said</a>:</p>
<blockquote>
<p>I may be a broken record at this point, but I'll mention again that also some shared state <em>cannot</em> enter an inconsistent state (eg: a single field)</p>
</blockquote>
<p>That's not true. Consider the case of an AlwaysEvenInteger, which has a method where it's updated by two successive <code>*x = x.checked_add(1).unwrap()</code>. If one of them triggers overflow, It could be left in an "inconsistent" state because it didn't get to execute the 2nd addition.</p>
<p>That said personally I've never wanted lock poisoning behavior, and largely agree with <span class="user-mention" data-user-id="243558">@Steven Fackler</span>'s comments — IME the vast majority of the time stuff is fine, and the poisoning behavior is undesirable and leads to meaningfully less robust software.</p>
<p>I'll also note that there's a nontrivial cost associated with implementing lock poisoning (admittedly it's been reduced somewhat recently), which often pushes people towards custom solutions regardless, which IMO isn't a great situation.</p>



<a name="219902313"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219902313" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Quy Nguyen <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219902313">(Dec 14 2020 at 21:08)</a>:</h4>
<p>Arguing that there aren't <code>some</code> scenarios by using a counterexample seems disingenuous to me.</p>



<a name="219903651"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/219903651" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Thom Chiovoloni <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#219903651">(Dec 14 2020 at 21:21)</a>:</h4>
<p>Fair enough, I was more arguing that the single field scenario isn't universally a case like that.</p>



<a name="220076831"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/220076831" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#220076831">(Dec 16 2020 at 04:41)</a>:</h4>
<p>I've personally been leaning towards introducing a <code>Poison&lt;T&gt;</code> type, so that our current <code>std::sync::Mutex</code> would become semantically like:</p>
<div class="codehilite" data-code-language="Rust"><pre><span></span><code><span class="k">type</span> <span class="nc">std</span>::<span class="n">sync</span>::<span class="n">Mutex</span><span class="o">&lt;</span><span class="n">T</span><span class="o">&gt;</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">std</span>::<span class="n">mutex</span>::<span class="n">Mutex</span><span class="o">&lt;</span><span class="n">Poison</span><span class="o">&lt;</span><span class="n">T</span><span class="o">&gt;&gt;</span><span class="w"></span>
</code></pre></div>
<p>I use poisoning a lot in my day-to-day codebase, but around files where it's not just panics, but most IO errors that cause us to poison files and operations. There aren't any locks to be seen there. Since locks also aren't the only way to share state across unwind boundaries it doesn't seem the most useful place for that behavior to live.</p>
<p>I've also come around to <span class="user-mention" data-user-id="143274">@Amanieu</span>'s suggestion to deprecate <code>UnwindSafe</code> and <code>RefUnwindSafe</code>, removing them from <code>panic::catch_unwind</code>. My own experience with these types is that they seem like they could be really useful traits, but the invariants they manage are too spongy for the current system to really protect, and the cases when you need them are uncommon enough that a lot of libraries ignore them. As an auto-trait system they don't seem to pull their weight.</p>



<a name="220080698"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/220080698" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> scottmcm <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#220080698">(Dec 16 2020 at 06:01)</a>:</h4>
<p>On the lang side we keep having conversations about never doing any more <code>auto trait</code>s, so +1 to deprecating those if they're not pulling their weight.</p>



<a name="220081758"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/220081758" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Lokathor <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#220081758">(Dec 16 2020 at 06:26)</a>:</h4>
<p>I would argue that they in fact anti-pull their weight: they use the word "safe" in a context where memory safety <strong>isn't</strong> involved, but the docs are vague and imply (to many readers) that it <em>might</em> be involved.</p>



<a name="220509279"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/220509279" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Matthias247 <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#220509279">(Dec 20 2020 at 08:25)</a>:</h4>
<p>My 2ct's on this: I think the ability to detect and <strong>handle</strong> poisoning is very import for synchronization primitives which protect shared memory which is shared <strong>between different processes</strong>. If another process crashed, the shared state might be in inconsistent state, and something needs to clean it up. Crashing the local process is not the answer here, because the corrupted shared memory might still stay around. </p>
<p>However for intra-process Mutexes I never found it useful to handle poisoned Mutexes. Most of the code I've written using Mutexes assumes that code executed while holding the lock never panics. If it does, something is very wrong, and the shared state might again not be in any well-defined and consistent state. Like with any kind of memory corruption or cache poisoning, continuing to run from there is dangerous. The current poisoning API allows to detect and fix the situation. However since it's not an expected state, I many people (including me) will skip handling it. And even if they do it might be barely tested and still have issues.<br>
That's why I'm not opposed to having a default behavior which panics again when trying to access such a log.</p>



<a name="220540105"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/220540105" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#220540105">(Dec 20 2020 at 22:20)</a>:</h4>
<p><span class="user-mention" data-user-id="204219">@Matthias247</span> I agree entirely. I'd also love for the default behavior to have zero overhead if compiling with <code>panic="abort"</code>, if possible.</p>



<a name="220542155"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/220542155" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#220542155">(Dec 20 2020 at 23:19)</a>:</h4>
<p>Some results from the survey: <a href="https://hackmd.io/2vuxXQL6Ruqaa6FZJKit_g">https://hackmd.io/2vuxXQL6Ruqaa6FZJKit_g</a></p>



<a name="220542239"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/220542239" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#220542239">(Dec 20 2020 at 23:21)</a>:</h4>
<p>We got 786 total respondents <span aria-label="tada" class="emoji emoji-1f389" role="img" title="tada">:tada:</span> I'll write up a follow-up post exploring the results more thoroughly. That's just a dump of some of the total breakdowns. I think the interesting data will be in cross-sections of how different user needs translate to different poisoning strategies</p>



<a name="220542297"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/220542297" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#220542297">(Dec 20 2020 at 23:22)</a>:</h4>
<p>I'll check in with the core team (or community team?) about publishing the raw results too. We had a few free text inputs but I did put a warning about information leakage there so hopefully the results should be pretty sanitized already <span aria-label="smile" class="emoji emoji-1f642" role="img" title="smile">:smile:</span></p>



<a name="220542361"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/220542361" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#220542361">(Dec 20 2020 at 23:24)</a>:</h4>
<p>It's looking like many users like the idea of getting rid of <code>.lock().unwrap()</code>. If they're not thinking about poisoning that might mean propagating panics automatically, and if they are that might mean suppressing them</p>



<a name="220547877"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/220547877" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Matthias247 <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#220547877">(Dec 21 2020 at 02:04)</a>:</h4>
<p>That's the part I found tricky about the survey. </p>
<blockquote>
<p>Do you think you’ve benefited from the standard library’s lock types providing poisoning by default?</p>
</blockquote>
<p>and </p>
<blockquote>
<p>Do you think you’ve benefited from the standard library’s lock types providing poisoning by default?</p>
</blockquote>
<p>do not really make a distinction between</p>
<ul>
<li>a new Mutex which would still track poisoning, and always panic/abort on follow-up accesses</li>
<li>a new Mutex which would ignore previous panics, and allow follow-up accesses</li>
</ul>



<a name="220553608"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/220553608" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Josh Triplett <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#220553608">(Dec 21 2020 at 05:00)</a>:</h4>
<p>(Did you mean to copy two separate wordings there?)</p>



<a name="220553770"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/220553770" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#220553770">(Dec 21 2020 at 05:04)</a>:</h4>
<p><span class="user-mention" data-user-id="204219">@Matthias247</span> Yeh, in retrospect we probably could've made it easier to distinguish, but I'm interested to try slice it up by answers to what users want to happen when a lock is poisoned</p>



<a name="220553904"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/220553904" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Matthias247 <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#220553904">(Dec 21 2020 at 05:08)</a>:</h4>
<blockquote>
<p>(Did you mean to copy two separate wordings there?)</p>
</blockquote>
<p>Oops - indeed! I also meant to copy </p>
<blockquote>
<p>How much friction do you think would be involved in migrating any of your projects from the standard library’s poisoning lock types to a non-poisoning lock crate?</p>
</blockquote>
<p>which will also vary a bit.</p>



<a name="220569675"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/220569675" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Elichai Turkel <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#220569675">(Dec 21 2020 at 10:18)</a>:</h4>
<p>Trying not to hijack the conversation, but anyone knows of any writeup of:<br>
A. Different poisoning techniques and handling of panicked threads.<br>
B. What other languages do in that area.</p>



<a name="223189155"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/219381-t-libs/topic/lock%20poisoning%20survey/near/223189155" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Ashley Mannix <a href="https://rust-lang.github.io/zulip_archive/stream/219381-t-libs/topic/lock.20poisoning.20survey.html#223189155">(Jan 19 2021 at 05:39)</a>:</h4>
<p>I've published the raw results from the Lock Poisoning Survey in our <code>libs-team</code> repository: <a href="https://github.com/rust-lang/libs-team/tree/main/data/2020-12-11-poisoning-survey">https://github.com/rust-lang/libs-team/tree/main/data/2020-12-11-poisoning-survey</a></p>
<p>I'm working on a follow-up post now exploring them, but if anybody else is keen to have a poke through them they're stored in CSV, along with a little tool that deserializes them to plain-old-structs if you wanted to grab them in a different format.</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>